Cybersecurity · Industry brief

The New York Department of Financial Services issued a cybersecurity alert regarding an active cyber campaign targeting a known vulnerability in remote monitoring and management platforms, urging DFS-regulated entities using managed service providers to assess and mitigate risks. Additionally, DFS imposed a $250,000 penalty against a licensed money transmitter for cybersecurity deficiencies, including failure to maintain adequate policies governing system updates and inadequate risk assessments.

The U.S. Department of Defense suspended CMMC Phase II requirements scheduled for November to reduce audit costs and bureaucratic burdens on small and mid-sized defense contractors. A newly formed CMMC Reform Task Force is analyzing industry feedback with a 60-day window to deliver recommendations by mid-September 2026 on whether to restructure the program, particularly regarding mandatory third-party cybersecurity assessments (C3PAO). The task force faces a tradeoff between maintaining high security standards for protecting sensitive government data and keeping compliance burdens manageable enough for smaller suppliers to remain competitive in the defense industrial base. The RFI public comment period closed August 14, with Phases 3 and 4 also on hold pending the review's conclusion.

California's CCPA now requires annual cybersecurity audits and privacy risk assessments for many businesses, creating new compliance obligations with phased deadlines. Organizations should assess their coverage and begin preparing documentation and certifications to avoid compliance gaps, according to Alston & Bird's Privacy, Cyber & Data Strategy Group.